[Dataset] pdx/vwave (v. 2007-09-14)

top

A new traceset (pdx/vwave/wlan_nano) has been added.

@MISC{pdx-vwave-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} data set pdx/vwave (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave},
  month = sep,  
  year = 2007
}
					

We collected six wireless LAN traffic traces around Portland, Oregon using 
a commercial sniffer VWave which has a nano-second time resolution.

Analysis of the MAC-level behavior of WLANs is required in order to better
deploy and design future systems. To this end, collection and analysis of 
traffic traces is an important task. We collected six traffic traces 
around Portland, Oregon using a commercial sniffer VWave which has a nano-second 
time resolution, and conduct an analysis of fine time scale (second or fraction 
of a second) packet, flow, and error characteristics of these networks.

We collected data at six different locations of which three 
(first three below) were located on-campus and three off-campus:
- PSU (Portland State University) CS Department Near Faculty Offices in Networking Closet
- PSU Library, 3rd Floor
- PSU Cafeteria
- Office overlooking ``Pioneer Square'' from the second floor
- Urban Grind Coffee 
- Worldcup Coffee at Powell's Books

These traces were collected using a VeriWave WT20 Appliance which was 
kindly loaned to us by the folks at VeriWave (http://www.veriwave.com). 
The WT20 hardware consists of two 802.11 reference radios, real-time 
linux, and two processors. The WT20 provides nanosecond resolution 
timestamps and it logs the time when it began seeing a frame and 
the time when the frame finished arriving.

We face two challenges in data collection: The first is placement of
the VWave sniffer. Because it has a lower effective receiver sensitivity
than most access points today (-75dBm versus -90dBm), we must prevent a
large possible packet loss with careful antenna choice and placement. 
The second problem is practical -- we had to obtain permission from 
the three merchants and further needed to ensure that our equipment 
was as unobtrusive as possible so as not to affect the ``normal'' behavior
of the users.

We used the anonymization tool developed by David Kotz et al.
for santizing the CRAWDAD/Dartmouth traces. It is based on the
prefix-preserving anonymization scheme presented in:
  
  Xu, J., Fan, J. Ammar, M., and Moon, S. 2002. ``On the Design and
  Performance of Prefix-Preserving IP Traffic Trace Anonymization'',
  Proc. of 10th IEEE International Conference on Network Protocols (ICNP
  2002), Paris, France, November 2002.
  http://www.cc.gatech.edu/~jx/reprints/ICNP02A.pdf

More recent publications (V. Paxson 2006) have shown that there
are still attacks possible with this level of anonymization. 
We have chosen to anonimize the traces as much as possible without losing
the most interesting features. Our expectation is that the remaining
information that could be extracted with such an attack is
uninteresting enough to bore most attackers. Moreover, all
traces were collected on unencrypted networks in public locations
and with the permission of the network-operators - users of such
networks should have low expectations for the privacy of their
traffic to begin with.

We:
  * Anonymized the IPs, in a prefix-preserving way
  * Anonymized the MACs, keeping the OUI identifiers intact
  * Stripped everything after the TCP/UDP header

[Traceset] pdx/vwave/wlan_nano (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace set pdx/vwave/wlan_nano (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano},
  month = sep,  
  year = 2007
}
					

This traceset contains supplimentary information for the corresponding pcap files 
in pdx/vwave/wlan_pcap, which are six wireless LAN traffic traces around Portland, 
Oregon, collected using a commercial sniffer VWave which has a nano-second time 
resolution.

These traces were collected using a VeriWave WT20 Appliance
which was kindly loaned to us by the folks at
VeriWave (http://www.veriwave.com).

The WT20 hardware consists
of two 802.11 reference radios, real-time linux, and two
processors. The WT20 provides nanosecond resolution timestamps and it logs the
time when it began seeing a frame and the time when the frame finished
arriving. We are using Veriwave WT20 in a somewhat novel
way. It listens with two radios simultaneously on the same channel,
recording frames to a per-radio, 256 MB, ring-buffer. The The WT20's
firmware will discard any frames received with a signal less than -75
dBm, but the rest (Data and Management, but not Control) are logged
without any scrubbing. A tclsh script, running on a laptop
connected to the WT20 (via ethernet), grabs the
contents of this ring-buffer from each radio in-turn, every 10
seconds. This data is dumped as a VWR file, a proprietary Veriwave
file format, and then converted to a libpcap file on the fly. At the
end of a 4 hour capture we have 1440 files which are stitched together
using a program we have developed for this purpose (after finding that
existing tools like mergecap and tcpslice either contained bugs or
didn't work with 802.11 traces).

These traces are the result of the additional data contained
in the VWR files and not in the pcap files. We used a tool ("log_dump")
provided to us as a binary by VeriWave to extract this information,
a custom script to parse the output, and then another custom script
to stich the many small files together time-wise (omitting redundant
portions).

[Traceset] pdx/vwave/wlan_pcap (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace set pdx/vwave/wlan_pcap (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap},
  month = aug,  
  year = 2007
}
					

Traceset of six wireless LAN traffic traces around Portland, Oregon, collected
using a commercial sniffer VWave which has a nano-second time resolution.

The WT20 hardware consists of two 802.11 reference radios, real-time 
linux, and two processors. The WT20 provides nanosecond resolution 
timestamps and it logs the time when it began seeing a frame and 
the time when the frame finished arriving. 

We are using Veriwave WT20 in a somewhat novel way. It listens 
with two radios simultaneously on the same channel, recording frames 
to a per-radio, 256 MB, ring-buffer. 

The WT20's firmware will discard any frames received with a signal 
less than -75 dBm, but the rest (Data and Management, but not Control) 
are logged without any scrubbing. A tclsh script, running on a laptop
connected to the WT20 (via ethernet), grabs the contents of this ring-buffer 
from each radio in-turn, every 10 seconds. 

This data is dumped as a VWR file, a proprietary Veriwave file format, 
and then converted to a libpcap file on the fly. At the end of a 4 hour 
capture we have 1440 files which are stitched together using a program 
we have developed for this purpose (after finding that existing tools 
like mergecap and tcpslice either contained bugs or didn't work with 802.11 traces).

[Trace] pdx/vwave/wlan_nano/psu-cs (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-psu-cs-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/psu-cs (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/psu-cs},
  month = sep,  
  year = 2007
}
					

Supplementary information for a pcap trace (pdx/vwave/wlan_pcap/psu-cs) 
collected from PSU (Portland State University) CS Department.

Where: PSU (Portland State University) CS Department Near Faculty Offices in Networking Closet
Duration: 1 Hour (1500 - 1600), Monday
Description: The capture antennas were placed
     at the same level and immediately in front of the access-point
     antennas. The closest clients are at least one wall away. We used
     this site for prototyping our capture methodologies.

Each trace here contains these fields:

  starting second (measured from start of capture)
  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_nano/library (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-library-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/library (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/library},
  month = sep,  
  year = 2007
}
					

Supplementary information for a Wireless LAN traffic trace 
(pdx/vwave/wlan_pcap/library) collected from PSU (Portland State University) Library.

Where: PSU (Portland State University) Library, 3rd Floor
Duration: 4 Hours (1400 - 1800), Monday
Description: Each library floor is covered by at least three
     access-points. We positioned our capture antenna on a
     table, about 4 feet away from the access-point antenna (ceiling
     mounted) and with roughly the same vantage.

Each trace here contains these fields:
  starting second (measured from start of capture)  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_nano/cafeteria (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-cafeteria-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/cafeteria (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/cafeteria},
  month = sep,  
  year = 2007
}
					

Supplementary information for a wireless LAN traffic trace 
(pdx/vwave/wlan_pcap/cafeteria) collected from PSU (Portland State University) Cafeteria.

Where: PSU (Portland State University) Cafeteria
Duration: 4 Hours (0930 - 1330), Monday 
Description: For this capture we placed our capture antenna
     directly under a sector antenna which serves the cafeteria. The room
     is mostly free of impediments, providing line-of-sight to nearly all
     users.

Each trace here contains these fields:
  starting second (measured from start of capture)  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_nano/pioneer-sq (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-pioneer-sq-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/pioneer-sq (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/pioneer-sq},
  month = sep,  
  year = 2007
}
					

Supplementary information for a Wireless LAN traffic trace 
(pdx/vwave/wlan_pcap/pioneer-sq) collected from a large outdoor area in downtown Portland.

Where: Office overlooking ``Pioneer Square'' from the second floor
Duration: 4 Hours (1130 - 1530), Monday
Description: This location serves Pioneer Square, a large
     common outdoor area in downtown Portland, and surrounding coffee-shops and
     businesses. We setup the VeriWave WT20's antenna to the side of the
     access-point antenna, in a neighboring room. One wall and about
     5 feet separated the capture antenna from the access-point antenna.

Each trace here contains these fields:
  starting second (measured from start of capture)  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_nano/urban-grind (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-urban-grind-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/urban-grind (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/urban-grind},
  month = sep,  
  year = 2007
}
					

Supplementary information for a wireless LAN traffic trace 
(pdx/vwave/wlan_pcap/urban-grind) collected from a coffee shop in Portland.

Where: Urban Grind Coffee 
Duration: 2 Hours (1300 - 1500), Thursday 
Description: The Urban Grind is a popular coffee-shop in
     Portland for laptop-users, and gets as much or more laptop-traffic
     then any other coffee-shop in Portland.  This space, like the cafeteria,
     has very few impediments - both the access-point and the capture
     antenna have line of sight to nearly every client device. The capture
     antenna was placed approximately 10 feet from the ceiling-mounted
     access point.

Each trace here contains these fields:
  starting second (measured from start of capture)  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_nano/powells (v. 2007-09-14)

top

the initial version

@MISC{pdx-vwave-wlan_nano-powells-2007-09-14,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_nano/powells (v. 2007-09-14)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_nano/powells},
  month = sep,  
  year = 2007
}
					

Supplementary information for a wireless LAN traffic trace 
(pdx/vwave/wlan_pcap/powells) collected from a coffee shop at a bookstore in Portland.

Where: Worldcup Coffee at Powell's Books
Duration: 4 Hours (1030 - 1430), Monday 
Description: The coffee shop at Powells sees a typical, slow but steady
     stream of laptop users. Aside from a couple of book-cases, it is a
     mostly open space. We positioned our capture antenna on a bookshelf
     approximately 8 feet above the ground to have good line-of-site to the
     access-point and the laptop-using patrons.

Each trace here contains these fields:
  starting second (measured from start of capture)  starting nanosecond
  ending second
  ending nanosecond
  size (octets)
  RSSI (calculated)
  RSSI (raw)
  FCS error (1 if FCS is bad, 0 otherwise)

Fields are separated by non-breaking whitespace,
records by newlines.

Using timestamps, these traces can be correlated ("merged")
with the pcap files. However, note that these
files are unfiltered:

  * They are not filtered by BSSID, they contain
    everything the radio could hear and decipher
    (the pcap files are limited to the AP we were
    studying (and had permission to monitor)).

  * They contain all frames, including control
    and management (the pcap files have control
    frames excluded).

[Trace] pdx/vwave/wlan_pcap/psu-cs (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-psu-cs-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/psu-cs (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/psu-cs},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from PSU (Portland State University) CS Department.

Where: PSU (Portland State University) CS Department Near Faculty Offices in Networking Closet
Duration: 1 Hour (1500 - 1600), Monday
Description: The capture antennas were placed
     at the same level and immediately in front of the access-point
     antennas. The closest clients are at least one wall away. We used
     this site for prototyping our capture methodologies.

tcpdump (pcap) format

[Trace] pdx/vwave/wlan_pcap/library (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-library-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/library (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/library},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from PSU (Portland State University) Library.

Where: PSU (Portland State University) Library, 3rd Floor
Duration: 4 Hours (1400 - 1800), Monday
Description: Each library floor is covered by at least three
     access-points. We positioned our capture antenna on a
     table, about 4 feet away from the access-point antenna (ceiling
     mounted) and with roughly the same vantage.

tcpdump (pcap) format

[Trace] pdx/vwave/wlan_pcap/cafeteria (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-cafeteria-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/cafeteria (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/cafeteria},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from PSU (Portland State University) Cafeteria.

Where: PSU (Portland State University) Cafeteria
Duration: 4 Hours (0930 - 1330), Monday 
Description: For this capture we placed our capture antenna
     directly under a sector antenna which serves the cafeteria. The room
     is mostly free of impediments, providing line-of-sight to nearly all
     users.

tcpdump (pcap) format

[Trace] pdx/vwave/wlan_pcap/pioneer-sq (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-pioneer-sq-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/pioneer-sq (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/pioneer-sq},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from a large outdoor area in downtown Portland.

Where: Office overlooking ``Pioneer Square'' from the second floor
Duration: 4 Hours (1130 - 1530), Monday
Description: This location serves Pioneer Square, a large
     common outdoor area in downtown Portland, and surrounding coffee-shops and
     businesses. We setup the VeriWave WT20's antenna to the side of the
     access-point antenna, in a neighboring room. One wall and about
     5 feet separated the capture antenna from the access-point antenna.

tcpdump (pcap) format

[Trace] pdx/vwave/wlan_pcap/urban-grind (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-urban-grind-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/urban-grind (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/urban-grind},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from a coffee shop in Portland.

Where: Urban Grind Coffee 
Duration: 2 Hours (1300 - 1500), Thursday 
Description: The Urban Grind is a popular coffee-shop in
     Portland for laptop-users, and gets as much or more laptop-traffic
     then any other coffee-shop in Portland.  This space, like the cafeteria,
     has very few impediments - both the access-point and the capture
     antenna have line of sight to nearly every client device. The capture
     antenna was placed approximately 10 feet from the ceiling-mounted
     access point.

tcpdump (pcap) format

[Trace] pdx/vwave/wlan_pcap/powells (v. 2007-08-13)

top

the initial version

@MISC{pdx-vwave-wlan_pcap-powells-2007-08-13,
  author = {Caleb Phillips and Suresh Singh},
  title = {{CRAWDAD} trace pdx/vwave/wlan_pcap/powells (v. 2007-08-13)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/pdx/vwave/wlan_pcap/powells},
  month = aug,  
  year = 2007
}
					

Wireless LAN traffic trace collected from a coffee shop at a bookstore in Portland.

Where: Worldcup Coffee at Powell's Books
Duration: 4 Hours (1030 - 1430), Monday 
Description: The coffee shop at Powells sees a typical, slow but steady
     stream of laptop users. Aside from a couple of book-cases, it is a
     mostly open space. We positioned our capture antenna on a bookshelf
     approximately 8 feet above the ground to have good line-of-site to the
     access-point and the laptop-using patrons.

tcpdump (pcap) format

[Author] Caleb Phillips

top

[Author] Suresh Singh

top

[Paper] phillips-wlan

top

In this paper, we analyze traffic seen at public WLANs "in the wild" where we 
do not have access to any of the backend infrastructure. We study six such 
traces collected around Portland, Oregon and conduct an analysis of fine time 
scale (second or fraction of a second) packet, flow, and error characteristics 
of these networks.